ledgarr-log-live[.]pages[.]dev

This domain is classified as an elevated-risk credential harvesting phishing site targeting financial or corporate login credentials. Analysis indicates the infrastructure was specifically designed to mimic legitimate authentication portals, likely to capture usernames, passwords, and multi-factor authentication tokens from unsuspecting users. Infrastructure analysis reveals the domain ledgarr-log-live.pages.dev was registered through Cloudflare, Inc. and resolved to IP address 172.66.44.209. The domain was created on April 04, 2026, and is currently offline. Security telemetry shows 12 out of 95 detection engines flagged this domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was actively blocked by PhishDestroy. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy to phishing pages. Organizations should implement the following mitigation steps to counter credential harvesting threats. First, block the domain and associated IP address 172.66.44.209 at the perimeter firewall and DNS filtering layers. Second, deploy email filtering rules to quarantine messages containing this domain or similar patterns in URLs. Third, conduct a retrospective analysis of authentication logs for any successful or failed login attempts referencing this domain. Fourth, initiate password resets and MFA re-enrollment for any accounts that may have interacted with the site. Fifth, educate users on recognizing phishing indicators, particularly domains using subdomain spoofing techniques like ledgarr-log-live.pages.dev.